Home / server / Questions / 150616
In Process
Zian Choy
Asked: 2010-06-12 16:50:40 +0800 CST

Killing Self-resurrecting Files

  • 772

Local computer:

  • Dell desktop
  • Windows XP
  • Named "5"

Server:

  • Windows Server 2008
  • Named "W"

Whenever I delete a file, log out, and log in, the file reappears.

The files all supposedly live on the server (e.g. "\W\Home$\zchoy\Desktop") but even when the files are deleted from the server and the local computer, they come back.

I've already tried resetting the offline files cache.

I tried deleting a file and then synchronizing with the server. The file didn't come back.

However, as mentioned earlier, the file comes back once I log out and log in.

Edit:

The files are all located in \W\Home$\zchoy\Desktop and are all sorts of different types (doc, xls, exe, msi, whole folders, etc.).

windows-server-2008 windows-xp offline-files

1 Answers

  1. Your descriptions lacks some details. (Zoredache mentioned it in the comment). Does this happen only with the user zchoy? or do the files also appear again and again when you log on as a differnt user? can you give us some examples of the file names?

    Do you work in a domain? are there some gpo's which could lead to such behaviour? Like a logon script which copies or creates the files on the desktop.

    Are the files on the desktop really doc files and co? are the known file types hidden? Check it with a simple dir command (open a command prompt for it):

     pushd \W\Home$\zchoy\Desktop
 dir

    Then check your autostart folder on your client (start -> programs -> autostart). Also check the following registry keys for script or executable entries which could create the files.

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

    Next thing I would do is upload some of the file which appear magically on your desktop to virscan.org or a similar website to check them for infections.

    Also download and run the malicious software removal tool from microsoft on your client and if possible on the server. http://www.microsoft.com/security/malwareremove/default.aspx

    • 1